In Depth
A filter can only judge what it sees. Payload splitting exploits that by never showing the filter the whole picture. The attacker spreads the pieces of an instruction across separate variables, messages, or documents, each innocuous in isolation, then adds a step that tells the model to combine them: "let A be this, let B be that, now do A followed by B." Each part passes inspection. The assembled whole is the attack.
It is a close cousin of obfuscation. Both aim to keep the malicious payload from being recognized, one by disguising it, the other by fragmenting it. Payload splitting is especially effective against defenses that scan a single message or field, and against agents that pull text from several sources, since the fragments can arrive through different inputs the agent stitches together on its own.
The technique generalizes to any agent that composes context from multiple places. Retrieval-augmented agents, tools that combine fields, and multi-turn conversations all give an attacker room to plant fragments that only become dangerous once the model assembles them, which connects payload splitting to prompt injection delivered through retrieved content.
What It Looks Like
A vendor's agent screens submitted text for a banned instruction and blocks it. An attacker splits that instruction across three separate form fields, none of which contains the banned phrase, and adds a note telling the agent to read the fields in order and act on the combined text. Each field passes the screen. The agent concatenates them and follows the reconstructed instruction. The filter never saw the complete request, because it never existed in one field.
Why It Matters For AI Vendors
Payload splitting shows why per-input filtering gives a false sense of safety. An agent can pass every single-message check and still be compromised by the sum of them, which is hard to catch and easy to underestimate. It is particularly relevant for agents that assemble context from multiple sources or hold multi-turn conversations, which describes most useful agents. Defending against it means evaluating the fully assembled context and constraining the agent's actions, and red-teaming with split payloads so the gap shows up in a test rather than in production.